The PostgreSQL Global Development Group released emergency security updates on August 14, 2025, to address three critical vulnerabilities affecting PostgreSQL versions 13 through 17. The vulnerabilities include:
1. CVE-2025-8714: Allows arbitrary OS code execution via pg_dump meta-commands, with a CVSS score of 8.8.
2. CVE-2025-8715: Facilitates code/SQL injection through improper newline handling in object names, also with a CVSS score of 8.8.
3. CVE-2025-8713: Exposes sensitive data via optimizer statistics, with a CVSS score of 3.1.
Organizations are advised to upgrade to PostgreSQL versions 17.6, 16.10, 15.14, 14.19, or 13.22 immediately. Cloud providers have begun emergency fleet updates, and development teams should audit their CI/CD pipelines for pg_dump usage. The vulnerabilities were disclosed responsibly by several individuals, and PostgreSQL 13 will reach its end-of-life on November 13, 2025.